securenow 8.12.1 → 8.12.2

package/README.md

@@ -111,6 +111,8 @@ npx securenow doctor         # diagnose config + connectivity
 npx securenow status         # dashboard summary
 ```
 
+**Tests** — test runs otherwise report to your real app with the project's `.securenow` credentials. `SECURENOW_DISABLED=1 npm test` turns the SDK off for that process: no traces, logs, events, firewall or session sync, and `guard()` just calls `next()`. This is the only setting read from the environment.
+
 ---
 
 ## Connect your coding agent (MCP)

package/cli/automation.js

@@ -198,18 +198,20 @@ async function dryRun(args, flags) {
     ui.keyValue([
       ['Scanned IPs', String(results.scanned ?? 0)],
       ['Matched IPs', String(results.matched ?? 0)],
+      ...(results.testModeMatched != null ? [['Test-mode matches', `${results.testModeMatched} (preview only: never acted on until the rule is promoted)`]] : []),
       ['Sample count', String((results.samples || []).length)],
     ]);
     if ((results.samples || []).length) {
       console.log('');
       const rows = results.samples.map((sample) => [
         sample.ip,
+        ui.truncate([].concat(sample.alertName || []).slice(-1).join(''), 40),
         ui.truncate((sample.path || []).join(', '), 32),
-        ui.truncate((sample.attackType || []).join(', '), 28),
         (sample.environment || []).join(', ') || '-',
         String(sample.riskScore ?? '-'),
+        sample.testMode ? 'test' : 'prod',
       ]);
-      ui.table(['IP', 'Paths', 'Attack', 'Env', 'Risk'], rows);
+      ui.table(['IP', 'Alert', 'Paths', 'Env', 'Risk', 'Mode'], rows);
     }
     console.log('');
   } catch (err) {

package/cli/ui.js

@@ -182,10 +182,19 @@ function prompt(question, opts = {}) {
 
   return new Promise((resolve) => {
     const q = opts.secret ? question : `  ${c.cyan('?')} ${question} `;
+    let answered = false;
     rl.question(q, (answer) => {
+      answered = true;
       rl.close();
       resolve(answer.trim());
     });
+    // stdin closed without an answer (EOF, /dev/null, a coding agent's shell): resolve empty instead of
+    // leaving the promise pending until the process silently exits.
+    rl.once('close', () => {
+      if (answered) return;
+      process.stderr.write('\n');
+      resolve('');
+    });
 
     if (opts.secret) {
       const onData = (char) => {
@@ -202,7 +211,15 @@ function prompt(question, opts = {}) {
 async function confirm(question, defaultYes = false) {
   const hint = defaultYes ? 'Y/n' : 'y/N';
   const answer = await prompt(`${question} ${c.dim(`(${hint})`)}`);
-  if (!answer) return defaultYes;
+  if (!answer) {
+    // A script or coding agent has no terminal to answer from: say so and exit non-zero instead of
+    // silently cancelling the write with exit code 0.
+    if (!defaultYes && !process.stdin.isTTY) {
+      error('No confirmation received (non-interactive shell). Re-run with --yes to confirm.');
+      process.exitCode = 1;
+    }
+    return defaultYes;
+  }
   return answer.toLowerCase().startsWith('y');
 }
 

package/console-instrumentation.js

@@ -64,18 +64,7 @@ const SeverityNumber = {
  * Format arguments into a log message
  */
 function formatMessage(args) {
-  return args
-    .map((arg) => {
-      if (typeof arg === 'object' && arg !== null) {
-        try {
-          return JSON.stringify(arg);
-        } catch (e) {
-          return String(arg);
-        }
-      }
-      return String(arg);
-    })
-    .join(' ');
+  return require('./log-format').formatLogArgs(args);
 }
 
 const { context, trace } = require('@opentelemetry/api');

package/events.js

@@ -139,6 +139,7 @@ function normalizeEvent(type, props) {
  */
 function track(type, props = {}) {
   try {
+    if (require('./sdk-disabled').sdkDisabled()) return;
     const ev = normalizeEvent(type, props);
     if (!ev) return;
     buffer.push(ev);

package/firewall-only.js

@@ -2,6 +2,8 @@
 
 // Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
 if (require('./internal-thread').inInternalThread()) return;
+// SECURENOW_DISABLED=1 turns the SDK off for this process (test runs).
+if (require('./sdk-disabled').sdkDisabled('firewall')) return;
 
 /**
  * Standalone firewall preload — no OpenTelemetry, no tracing.

package/firewall-paths.js

@@ -0,0 +1,46 @@
+'use strict';
+
+// Route matching for firewall block, rate-limit and challenge rules.
+//
+// Many servers answer more than one spelling of a path: Express 5 routes case-insensitively and ignores
+// a trailing slash, so POST /API/AUTH/LOGIN/ reaches the /api/auth/login handler. A rule matched only
+// against the raw path let those aliases walk past a route-scoped block. Rules now also match the
+// canonical form (percent-decoded, lower-case, duplicate slashes collapsed; exact rules also ignore a
+// trailing slash). Every caller enforces (block / rate-limit / challenge), so matching more spellings
+// is the safe direction.
+
+function normalizePrefixPattern(pattern) {
+  const value = String(pattern || '').trim();
+  if (!value) return '';
+  return value.endsWith('*') ? value.slice(0, -1) : value;
+}
+
+function canonicalPath(path, { stripTrailingSlash = false } = {}) {
+  let value = String(path || '/');
+  try { value = decodeURIComponent(value); } catch (_) { /* keep the raw spelling */ }
+  value = value.toLowerCase().replace(/\/{2,}/g, '/');
+  if (stripTrailingSlash && value.length > 1) value = value.replace(/\/+$/, '') || '/';
+  return value || '/';
+}
+
+function rulePathMatches(rule, path) {
+  const pattern = String((rule && rule.pathPattern) || '').trim();
+  if (!pattern) return true;
+  const mode = (rule && rule.pathMatchMode) || 'prefix';
+  if (mode === 'regex') {
+    try {
+      const re = new RegExp(pattern);
+      return re.test(path) || re.test(canonicalPath(path, { stripTrailingSlash: true }));
+    } catch (_) {
+      return false;
+    }
+  }
+  if (mode === 'exact') {
+    return path === pattern
+      || canonicalPath(path, { stripTrailingSlash: true }) === canonicalPath(pattern, { stripTrailingSlash: true });
+  }
+  const prefix = normalizePrefixPattern(pattern);
+  return path.startsWith(prefix) || canonicalPath(path).startsWith(canonicalPath(prefix));
+}
+
+module.exports = { canonicalPath, normalizePrefixPattern, rulePathMatches };

package/firewall.js

@@ -911,16 +911,8 @@ function ruleIpMatches(rule, ip) {
   }
 }
 
-function rulePathMatches(rule, path) {
-  const pattern = String(rule.pathPattern || '').trim();
-  if (!pattern) return true;
-  const mode = rule.pathMatchMode || 'prefix';
-  if (mode === 'exact') return path === pattern;
-  if (mode === 'regex') {
-    try { return new RegExp(pattern).test(path); } catch (_) { return false; }
-  }
-  return path.startsWith(normalizePrefixPattern(pattern));
-}
+// Matches the raw path and its canonical aliases (case, trailing/duplicate slashes, percent-encoding).
+const { rulePathMatches } = require('./firewall-paths');
 
 function rateLimitKey(rule, ip) {
   const id = rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`;

package/log-format.js

@@ -0,0 +1,28 @@
+'use strict';
+
+// Body of an exported console log record, matching what the terminal shows.
+// - A first string argument with printf-style placeholders (%s %d %i %f %j %o %O %c %%) is formatted
+//   like console.log does (util.format), so "%d users" becomes "3 users" instead of "%d users 3".
+// - Errors keep their stack (JSON.stringify(new Error('x')) is "{}").
+// - Other objects stay JSON, as before, so structured logs remain parseable.
+const util = require('util');
+
+const PLACEHOLDER = /%[sdifjoOc%]/;
+
+function renderArg(arg) {
+  if (arg instanceof Error) return arg.stack || `${arg.name}: ${arg.message}`;
+  if (typeof arg === 'object' && arg !== null) {
+    try { return JSON.stringify(arg); } catch (_) { return util.inspect(arg, { depth: 4, breakLength: Infinity }); }
+  }
+  return String(arg);
+}
+
+function formatLogArgs(args) {
+  if (!Array.isArray(args) || args.length === 0) return '';
+  if (typeof args[0] === 'string' && PLACEHOLDER.test(args[0])) {
+    try { return util.format(...args); } catch (_) { /* fall through */ }
+  }
+  return args.map(renderArg).join(' ');
+}
+
+module.exports = { formatLogArgs };

package/nextjs.js

@@ -221,6 +221,7 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
  * @param {boolean} options.noUuid - Don't append UUID to service name
  */
 function registerSecureNow(options = {}) {
+  if (require('./sdk-disabled').sdkDisabled('nextjs')) return;
   // Only register once
   if (isRegistered) {
     console.log('[securenow] Already registered, skipping...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.12.1",
+  "version": "8.12.2",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -10,7 +10,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-log-format.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -162,6 +162,9 @@
     "legacy-semconv.js",
     "otp-redaction.js",
     "header-redaction.js",
+    "firewall-paths.js",
+    "log-format.js",
+    "sdk-disabled.js",
     "rate-limits.js",
     "rate-limits.d.ts",
     "firewall-only.js",

package/register.js

@@ -8,6 +8,8 @@
 
 // Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
 if (require('./internal-thread').inInternalThread()) return;
+// SECURENOW_DISABLED=1 turns the SDK off for this process (test runs).
+if (require('./sdk-disabled').sdkDisabled('register')) return;
 
 // 1. Auto-register the ESM loader hook so customers never need --import
 (() => {

package/sdk-disabled.js

@@ -0,0 +1,18 @@
+'use strict';
+
+// Kill switch: SECURENOW_DISABLED=1 (or true / yes / on) turns the SDK off for one process. Tracing, log
+// export, the firewall, track() events and the sessions guard's sync and session.seen all stay idle, and
+// the guard just calls next(). Meant for unit and integration test runs, which otherwise report to the
+// real app with the project's .securenow credentials.
+let _announced = false;
+
+function sdkDisabled(component) {
+  const on = /^(1|true|yes|on)$/i.test(String(process.env.SECURENOW_DISABLED || '').trim());
+  if (on && component && !_announced) {
+    _announced = true;
+    try { console.log(`[securenow] disabled by SECURENOW_DISABLED (${component} not started)`); } catch (_) { /* ignore */ }
+  }
+  return on;
+}
+
+module.exports = { sdkDisabled };

package/sessions.js

@@ -130,6 +130,7 @@ function isRevoked(input) {
 }
 
 function start(options = {}) {
+  if (require('./sdk-disabled').sdkDisabled()) return;
   if (options.syncIntervalMs) _syncIntervalMs = options.syncIntervalMs;
   if (_started) return;
   _started = true;
@@ -277,6 +278,7 @@ function defaultOnRevoked(req, res) {
  * @param {number} [options.syncIntervalMs]
  */
 function guard(options = {}) {
+  if (require('./sdk-disabled').sdkDisabled('sessions guard')) return function securenowSessionGuardDisabled(req, res, next) { return next(); };
   start(options);
   if (options.captureWindowMs) _captureWindowMs = options.captureWindowMs;
   const { getSessionId, getUserId } = options;

package/tracing.js

@@ -2,6 +2,8 @@
 
 // Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
 if (require('./internal-thread').inInternalThread()) return;
+// SECURENOW_DISABLED=1 turns the SDK off for this process (test runs).
+if (require('./sdk-disabled').sdkDisabled('tracing')) return;
 
 /**
  * Preload with: node --require securenow/register app.js
@@ -665,7 +667,7 @@ if (loggingEnabled) {
       _logger.emit({
         severityNumber: sn,
         severityText: st,
-        body: args.map(a => (typeof a === 'object' && a !== null) ? JSON.stringify(a) : String(a)).join(' '),
+        body: require('./log-format').formatLogArgs(args),
         attributes: { 'log.source': 'console', 'log.method': st.toLowerCase() },
         ...(spanCtx && { context: activeCtx }),
       });